[Haoming9527]

Refs #872. Stacked on #924.

What was wrong

Result put/page/release and batch plan/run/resume still started a public one-shot OPS worker after the file/fresh/cleanup migration. The initial real routing regression failed all three checks on that path. Removing the existing OS confinement was not an equivalent fix: a selected root can change after host preparation.

The change

Windows restricted calls now send the exact public confinement argv, working directory and scrubbed environment through the existing resident request lifetime. The native atomic Job range owns the runner before bounded stdin delivery; cancellation joins stdin, both output readers and descendants. Full-access calls reuse the fixed worker leaf on supported platforms. confined-worker-v1 fails closed on older kernels; admission failure never falls back or replays.

The native deadline covers launch/physical-start acknowledgement/input before worker decoding. Known early nonzero runner exits retain stderr even when stdin delivery ends in BrokenPipe, preserving existing fatal-runner and denial classifications. Current authority, private result grants, no-follow checks, audit IDs and unknown-effect semantics remain in place.

Restricted POSIX batch/result and explicit WSL reads retain their named platform transport. This draft does not close #872, change runtime pins, or claim a performance improvement. Bilingual docs and Unreleased entries describe the boundary. No dependencies, version, model-facing schemas or prompts changed. The diff has 594 source additions counting inline tests, excluding separate tests/docs.

Validation

Final Windows worker SHA-256: 024d5e80b9befe77dce3b3ad4bf6c2d4d40e236047054acc79dd9f7196192b2c.

cargo test --workspace --locked --manifest-path native/Cargo.toml
739 passed, 0 failed, 8 ignored subprocess fixtures (explicitly invoked by parent tests)
cargo clippy --workspace --all-targets --locked --manifest-path native/Cargo.toml -- -D warnings
passed

node test/run.mjs resident-ptc-routing native-result resident-kernel worker-boundary call-budget authority worker-protocol ptc-audit-refs result-cleanup-authority resident-worker-launch shells-electron-runner result-storage-host
108 checks passed, 3 failed; 11 suites passed, 1 failed, 0 skipped
The failures were existing authority mocks using relative executable "unused"; exact-launch
validation correctly refused those fixtures. They now use an absolute executable identity.
node test/run.mjs authority.test result-storage-cache-prep
30 checks passed, 3 suites passed, 0 failed/skipped

The above includes 8/8 real routing checks, 13/13 Native result checks and 21/21 resident
transport checks; 116 distinct affected checks are green after the fixture correction.
node test/run.mjs ptc.test
1 suite passed, all 6 printed end-to-end scenarios passed, 0 failed/skipped

node test/run.mjs permissions
15 checks passed with the verified legacy Bash fixture (earlier staged E2 worker).
npm run build; npm run typecheck; node scripts/validate-manifest.mjs
passed; manifest 92/92
node scripts/check-file-size.mjs
942 code files passed, longest 930 lines
git diff --check
passed

Real routing checks cover public confinement, root-junction replacement after preparation, Native/PTC reference ownership and paging/release, batch plan/run/resume, targeted cancellation, native stdin deadline without a caller timeout, both early-runner refusal signatures, and zero public one-shot OPS spawns through disposal. Raw red evidence is retained: the original route failed 3/3 initial checks; an intermediate kernel failed the stdin deadline; the next kernel passed six checks but failed both early-refusal checks. The final worker passes all eight. Earlier setup attempts (missing stage/legacy fixture and a worker-override conflict with package-resolution assertions) were corrected explicitly, not counted as passes.

Pull-request CI: Cross-platform validation / CI required passed for exact head 80dbcc8535271f7da460fe913d68783fdd6f163e. All 10 jobs are green, including Windows, Linux, both macOS architectures, the Node floor, tool trials, lint/size checks and the required aggregate. Windows completed 262 suites with 4 allowed skips; Linux completed 260 suites with 6 allowed skips. Windows native ownership, backpressure, spill, stock-driver and UNC checks also passed. This cross-platform result does not remove the documented POSIX ownership limitation or claim completion of #872.

Environment

Windows x64, Node v26.12.1, locked npm ci --ignore-scripts, actual public DSH policy/sandbox/subprocess services. Base 943c5bc966ab81a221eadd0e7d0ff01596833f75 (PR #924); local debug worker officially staged with the repository staging script. No model API calls.